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DETAILED ACTION 



1. Claims 1-80 are pending. 



Claim Rejections - 35 USC §112 



The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

2. Claim 22 is rejected under 35 U.S.C. 112, second paragraph, as being indefinite 
for failing to particularly point out and distinctly claim the subject matter which applicant 
regards as the invention. 

3. With regards to claim 22, the limitation "if not" is unclear because the claim does 
not provide a limitation whereby the "if not" is triggered. 



Claim Rejections - 35 USC § 102 



The following is a quotation of the appropriate paragraphs of 35 U.S.C. 1 02 that 
form the basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that ah international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 



Application/Control Number: 

10/680,965 

Art Unit: 2134 



Page 3 



4. Claims 1-14, 16-33, 35-37, 49, 45-47, 50-53, 55, 58, 60-72, and 74-80 are 
rejected under 35 U.S.C. 102(e) as being anticipated by Harvey et al US PGPub 
2004/0252837. 

5. With regards to claims 1, 13, 18-19, 22, 26, 29, 36-37, 39, 50-51, 55, 60, 62-63, 
65, 68-69, 71, 75, Harvey teaches an apparatus comprising: at least one processor; and 
one or more media including processor-executable instructions that are capable of 
being executed by the at least one processor (Harvey, Figure 1, Figure 2), the 
processor-executable instructions adapted to direct the apparatus to perform actions 
comprising: monitoring at least one signal characteristic for a plurality of signals that 
relate to a single source address (Harvey, paragraph 0106, paragraph 0107, looks for 
characteristics for a particular MAC address); and detecting a wireless interloper if a 
discrepancy is determined to exist with regard to the monitored at least one signal 
characteristic for the plurality of signals (Harvey, paragraph 0107, location discrepancy). 

6. With regards to claims 2, 16, 61, 74, 78, Harvey teaches the processor- 
executable instructions are adapted to cause the apparatus to perform further actions 
comprising: producing a plurality of communication beams; and receiving the plurality of 
signals via at least one communication beam of the plurality of communication beams 
(Harvey, paragraphs 0025-0029). 

7. With regards to claims 3, 21, 28, 52, Harvey teaches the apparatus comprises 
an access station or a remote client (Harvey, paragraph 0026). 
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8. With regards to claims 4, 27, Harvey teaches the apparatus further comprises: 
an antenna array having a plurality of antenna elements; and a beamformer coupled to 
the antenna array (Harvey, paragraph 0029). 

9. With regards to claims 5, 32, Harvey teaches the monitoring action comprises: 
ascertaining the at least one signal characteristic for the plurality of signals (Harvey, 
paragraph 0107, location). 

10. With regards to claims 6, 24-25, 30-31, 53, Harvey teaches the ascertaining 
action comprises: ascertaining the at least one signal characteristic as selected from the 
group comprising: arrival delay, arrival direction, multipath offset, signal frequency, and 
signal strength (Harvey, paragraph 0042, signal strength, location triangulation for 
arrival direction). 

1 1 . With regards to claim 7, Harvey teaches the processor-executable instructions 
are adapted to cause the apparatus to perform a further action comprising: determining 
if the discrepancy exists with regard to the monitored at least one signal characteristic 
for the plurality of signals (Harvey, paragraph 0107, location discrepancy). 

12. With regards to claims 8, 20, 64, 72, Harvey teaches the determining action 
comprises: determining if the monitored at least one signal characteristic for a first 
signal of the plurality of signals fails to be commensurate with the monitored at least one 
signal characteristic for a second signal of the plurality of signals (Harvey, paragraph 
0042, 0107). 

13. With regards to claim 9, Harvey teaches the determining action comprises: 
determining if a bi-modal distribution exists responsive to a predetermined threshold 
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with regard to the monitored at least one signal characteristic for the plurality of signals 
(Harvey, paragraph 0107-0108). 

14. With regards to claims 10, 14, 17, 45, 46, 58, 66, 70, 79-80, Harvey teaches 
everything described above and further teaches the processor-executable instructions 
are adapted to cause the apparatus to perform a further action comprising: if a wireless 
interloper is detected in the detecting action, countering the wireless interloper (Harvey, 
paragraphs 0122-0123, alerts raised to spoofing attacks). 

15. With regards to claim 11, 67, Harvey teaches the monitoring action comprises: 
receiving a plurality of packets having the at least one signal characteristic, each packet 
of the plurality of packets including the single source address (Harvey, paragraph 0107, 
same MAC address). 

16. With regards to claim 12, Harvey teaches the detecting action comprises: 
detecting that two sources exist for the plurality of signals that related to the single 
source address if a discrepancy is determined to exist with regard to the monitored at 
least one signal characteristic for the plurality of signals (Harvey, paragraphs 0122- 
0123, paragraphs 0106-0108). 

17. With regards to claim 23, Harvey teaches the first characteristic and the at least 
one second characteristic being spatial (Harvey, paragraph 0107, location). 

18. With regards to claims 33, 35, 47, 76-77, Harvey teaches storing the at least 
one characteristic for a packet in an entry of a table corresponding to a particular 
address (Harvey, paragraphs 0108, 0042, 0127). 
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Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

19. Claims 15, 34, 38, 40-41, 48-49, 54, 56, 59, 73 are rejected under 35 U.S.C. 
103(a) as being unpatentable over Harvey et al US PGPub 2004/0252837 in view of 
Chelsa US PG Pub 2004/0250124. 

20. With regards to claims 15, 49, 59, Harvey teaches the action of countering 
comprises at least one action selected from the group comprising: providing notification 
of the detected wireless interloper (Harvey, paragraphs 0122-0123, alerts raised to 
spoofing attacks); recording the ascertained at least one signal characteristic for the 
plurality of signals that relate to the single source address (Harvey, paragraphs 0108, 
0042, 0127), but fails to teach terminating one or more communications that relate to 
the single source address. However, Chesla teaches terminating one or more 
communications that relate to the single source address (Chesla, paragraph 0426). At 
the time the invention was made, it would have been obvious to a person of ordinary 
skill in the art to utilize Chesla's method of terminating communications because it offers 
the advantage of blocking malicious traffic while minimizing the negative effects upon 
legitimate network traffic (Chesla, paragraph 0017). 

21 . With regards to claims 34, 38, 54, 56, 73, Harvey fails to teach increasing a 
packet tally at an ascertained value of the at least one characteristic at an entry 
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corresponding to the particular address and the threshold comprising a number of 
packets. However, Chesla teaches increasing a packet tally at an ascertained value of 
the at least one characteristic at an entry corresponding to the particular address and 
the threshold comprising a number of packets (Chesla, paragraph 0033). At the time 
the invention was made, it would have been obvious to a person of ordinary skill in the 
art to utilize Chesla's method of counting packets because it offers the advantage of 
aiding in determining the existence of an attack and in determining if filtering 
countermeasures are effective (Chesla, paragraph 0032). 
22. With regards to claims 40-41, Harvey fails to teach clearing the bi-modal 
distribution that exists with regard to the particular address; determining if the bi-modal 
distribution is presented again; and if so, detecting the interloper with regard to the 
particular address based on the re-presentation of the bi-modal distribution. However, 
Chesla teaches clearing the bi-modal distribution that exists with regard to the particular 
address; determining if the bi-modal distribution is presented again; and if so, detecting 
the interloper with regard to the particular address based on the re-presentation of the 
bi-modal distribution (Chesla, paragraph 0032-0033, detects intrusion, then filters, then 
restarts detection to determine if filters are effective). At the time the invention was 
made, it would have been obvious to a person of ordinary skill in the art to utilize 
Chesla's method of detection because it offers the advantage of blocking malicious 
traffic while minimizing the negative effects upon legitimate network traffic (Chesla, 
paragraph 0017). 
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23. With regards to claim 48, Harvey fails to teach recording a payload of the 
packet having the particular address. However, Chesla teaches recording a payload of 
the packet having the particular address (Chesla, paragraphs 0264-0265, records 
headers and payloads in buffers for analysis). At the time the invention was made, it 
would have been obvious to a person of ordinary skill in the art to utilize Chesla's 
method of detection because it offers the advantage of blocking malicious traffic while 
minimizing the negative effects upon legitimate network traffic (Chesla, paragraph 
0017). 

24. Claims 42, 43, 44, 57 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Harvey et al US PGPub 2004/0252837 in view of Bardsley et al US 
Patent No. 7,308,714. 

25. With regards to claims 42-44, 57, Harvey fails to teach applying an aging policy 
to logged characteristics for packets having the particular address. However, Bardsley 
teaches applying an aging policy to logged characteristics for packets having the 
particular address (Bardsley, column 5 lines 45-55, aging policy past 5 minutes). At the 
time the invention was made, it would have been obvious to a person of ordinary skill in 
the art to utilize Bardsley's method of using an aging policy because it offers the 
advantage of allowing fine tuning of attack signatures to allow detection of a signature of 
packets that occurs within a designated time window thus providing greater clarity of 
alerts to administrators (Bardsley, column 1 lines 30-50). 
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Conclusion 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Andrew L. Nalven whose telephone number is 571 272 
3839. The examiner can normally be reached on Monday - Thursday 8-6, Alternate 
Fridays. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kambiz Zand can be reached on 571 272 381 1 . The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

Andrew-NfJVen 




